Objective 2.1: Compare and contrast common threat actors and motivations
Cert: CompTIA Security+ (SY0-701) Domain: 2.0 Threats, Vulnerabilities, and Mitigations Weight: ~22% of SY0-701 (Domain 2 total) Depth: Compare and contrast. Be able to name the six threat actor categories, the ten motivations, and the three attributes used to compare actors side by side. Recognize the right actor and motivation when a scenario describes the behavior, the target, and the indicators.
What this objective tests
You should be able to name the six threat actor categories on the SY0-701 exam, the ten motivations the exam lists, and the three attributes used to compare actors. You should also be able to read a short alert summary or news clip and pick the most likely actor and motivation with one or two reasons. This is the first objective in Domain 2 and it sets the adversary frame every later objective references. SP-2.2 builds on it with threat vectors. SP-2.3 builds on both with vulnerabilities. The pattern across Domain 2 is who, why, then how.
Every SOC (Security Operations Center) Tier 1 analyst opens a shift in a queue full of alerts. The fastest way to triage an alert is to ask who and why before asking what or how. A beaconing alert from a workstation in the Pricing department reads very differently if the suspected actor is a nation-state running espionage versus an unskilled attacker who downloaded the wrong tool. The actor and the motivation guide the next two or three steps: which logs to pull, which user to call, whether to escalate to Tier 2. Naming the actor early earns trust from senior analysts because it shows you are thinking about the case, not just acknowledging the alert. The exam tests this skill in scenario format. Real life tests it every shift.
Key facts
The six threat actor categories
The SY0-701 exam lists six categories. They overlap in real life. The exam expects you to pick the strongest fit based on the behavior, the target, and the indicators.
| Actor | Plain English | Common motivation |
|---|---|---|
| Nation-state | Government-backed campaign, well funded, highly skilled. Almost always an APT (Advanced Persistent Threat). | Espionage, war, pre-positioning, sometimes data exfiltration |
| Organized crime | Criminal business. Ransomware crews, fraud rings, credential markets. | Financial gain |
| Hacktivist | Person or group attacking for a political or social cause. The attack is the message. | Philosophical or political beliefs |
| Insider threat | Anyone with legitimate access who causes harm, on purpose or by accident. | Revenge, financial gain, or no malicious intent (unintentional) |
| Unskilled attacker | Low-skill attacker, reuses tools written by someone else. Sometimes called a script kiddie. | Mixed: fame, boredom, low-effort financial gain |
| Shadow IT | Technology used by employees without IT approval. The user is rarely malicious. The asset is the problem. | No malicious intent. The motivation is convenience. The risk is loss of control. |
A few notes the exam loves to test:
- APT is a campaign pattern, not a label for any skilled attacker. Advanced (custom tools, sometimes zero-days). Persistent (months to years). Threat (focused goal). Almost always nation-state backed.
- Insider threats come in two flavors. Malicious insiders are angry, paid off, or building a side business. Unintentional insiders are well meaning people who fall for phishing, lose a laptop, or post a screenshot with secrets in the background. Both count for the exam. Both fill the SOC queue.
- Unskilled attackers are loud and easy to spot. Easy to spot does not mean harmless. A noisy attacker can still find an open door.
- Shadow IT is the category most students underestimate. The person setting up the unapproved SaaS tool is usually trying to get work done faster. They are still on the SY0-701 list because the asset they create sits outside the security perimeter. No monitoring, no policy, no backup.
The ten motivations
| Motivation | Plain English | Often paired with |
|---|---|---|
| Data exfiltration | Stealing data and moving it outside the organization. Sometimes shortened to exfil. | Nation-state, organized crime, malicious insider |
| Espionage | Spying. Goal is to learn secrets and stay quiet. | Nation-state |
| Service disruption | Taking systems down on purpose. DDoS (Distributed Denial of Service), ransomware, wipers. | Hacktivist, organized crime, nation-state (war) |
| Financial gain | Money. Ransom, wire fraud, fake invoices, stolen cards. | Organized crime, malicious insider |
| Philosophical or political beliefs | The actor is making a statement. The attack is the message. | Hacktivist |
| Revenge | Personal anger at a person or organization. | Malicious insider (most common), occasionally hacktivist |
| War | State-sponsored attacks during armed conflict. Often paired with espionage and disruption against critical infrastructure. | Nation-state |
| Blackmail | Threatening to release stolen or damaging information unless a demand is met. | Organized crime, malicious insider |
| Ethical | Acting to expose or force a fix for a weakness, framed as doing the right thing. | Hacktivist, security researcher |
| Disruption/chaos | Causing disorder for its own sake, without a clear financial or political goal. | Hacktivist, unskilled attacker |
One motivation can fit several actors. Financial gain drives organized crime, but it also drives a malicious insider stealing a customer list for a new job. Service disruption drives hacktivists with DDoS, organized crime with ransomware, and nation-states with wartime sabotage. The pattern of behavior matters more than the label.
The three attributes
The exam expects you to compare actors using three attributes at the same time.
- Internal versus external. Internal is anyone with legitimate access: employees, contractors, vendors with VPN. External is everyone else. Insider threats are internal. Nation-state, organized crime, hacktivist, and unskilled attackers are usually external. Shadow IT is internal but is not really attacking.
- Resources. Funding, time, and people the actor can bring to bear. Nation-state is very high. Organized crime is medium to high. Hacktivists vary. Insiders depend on their role and access. Unskilled attackers are low. Shadow IT is not an attacker and the attribute does not apply cleanly.
- Sophistication. How skilled the actor is. APTs are very high. Organized crime ransomware crews are medium to high. Hacktivists vary. Insiders vary by their role. Unskilled attackers are low.
This grid is the highest-yield content in the objective. Many SY0-701 questions hand you two or three attributes and ask which actor fits.
Actor attribute grid
| Actor | Internal vs external | Resources | Sophistication |
|---|---|---|---|
| Nation-state | External | Very high | Very high |
| Organized crime | External | Medium to high | Medium to high |
| Hacktivist | External | Low to medium | Low to medium |
| Insider (malicious) | Internal | Varies by role | Varies by skill |
| Insider (unintentional) | Internal | Low (not an attack) | Low |
| Unskilled attacker | External | Low | Low |
| Shadow IT | Internal | Not applicable | Not applicable |
Real-world examples (public sources)
- Nation-state. Public CISA Joint Cybersecurity Advisories attribute long-running campaigns to groups associated with Russia, China, North Korea, and Iran. Targets include defense contractors, energy utilities, telecoms, healthcare, and managed service providers. The reporting style itself is a clue: precise dwell times, custom tool names, slow exfiltration patterns.
- Organized crime. Public reporting by the FBI Internet Crime Complaint Center (IC3) and the Verizon Data Breach Investigations Report (DBIR) shows ransomware, business email compromise (BEC), and credential theft dominating financially motivated incidents year after year. Ransomware crews often run victim help desks, accept cryptocurrency, and negotiate payment terms.
- Hacktivist. Defacements and DDoS attacks tied to political events, including activity around elections, geopolitical conflict, and corporate controversies. Public claims on social media are part of the playbook because attention is the goal.
- Insider threat. Public US-CERT (Cybersecurity and Infrastructure Security Agency) reporting on insider cases includes departing employees who steal customer lists, contractors who keep credentials past their end date, and users who accidentally email sensitive files to the wrong address.
- Unskilled attacker. Public reporting on commodity malware and botnet rentals shows that a low-skill actor can rent a DDoS for an hour or a credential-stealing kit for a flat fee. The skill ceiling is low. The damage ceiling is not.
- Shadow IT. Vendor security reports and CASB (Cloud Access Security Broker) discovery data routinely find dozens to hundreds of unsanctioned SaaS apps per medium-sized organization. The user is usually not bad. The data sprawl is the problem.
How an analyst uses this in real life
The triage flow inside a SOC looks like this:
- Read the alert. What is the source rule, what asset, what time of day, what user.
- Ask who and why. Which actor category fits the pattern. Which motivation explains the goal.
- Pivot on the actor. Pull the next logs based on what that actor usually does. Beaconing patterns for nation-state. Lateral movement and credential dumping for organized crime. Public claims and timing for hacktivist.
- Confirm or correct with Tier 2. Threat intel teams reference frameworks like MITRE ATT&CK to match Tactics, Techniques, and Procedures (TTPs) to known groups.
- Document and hand off. Note the suspected actor and motivation in the ticket so the next analyst can pick up where you left off.
Naming the actor and the motivation does not solve the case by itself. It changes which question you ask next, and that is what shortens the response time.
Quick reference: scenario to actor matching
Use this table when reading scenario questions. The strongest single fit usually wins. When a scenario fits two actors, pick the one the indicators support best.
| Scenario shape | Most likely actor | Most likely motivation |
|---|---|---|
| Quiet, long dwell time, slow exfiltration, careful lateral movement | Nation-state (APT) | Espionage |
| Mass ransomware deployment with a victim help desk and crypto payment portal | Organized crime | Financial gain |
| Website defacement timed to a political event with a public claim | Hacktivist | Philosophical or political beliefs |
| Departing employee downloads a customer list to a personal drive | Insider (malicious) | Revenge or financial gain |
| User clicks phishing and credentials are reused from an unusual country | Insider (unintentional) at the start, organized crime running the follow-on | Financial gain |
| Botnet traffic from a free tool installed from a search ad | Unskilled attacker (commodity malware) | Service disruption or financial gain |
| Team uses a free SaaS tool on a personal credit card to store customer data | Shadow IT | No malicious intent. Convenience. |
| Sabotage in operational technology systems during armed conflict | Nation-state | War (often paired with disruption) |
Common gotchas
- Calling every attacker an APT. APT is a specific campaign pattern, almost always nation-state. A skilled criminal crew is not an APT. The exam will trap students who use the term loosely.
- Assuming all insider threats are malicious. Most insider cases are unintentional. Phishing victims and lost laptops fill the SOC queue more than disgruntled employees do. The exam tests this distinction directly.
- Underestimating unskilled attackers. Easy to detect does not mean low risk. The exam pairs unskilled attackers with real impact in scenario questions.
- Skipping shadow IT because the person is not bad. The user is not the threat actor in the usual sense. The asset is the problem. The exam keeps shadow IT on the list because of the data and policy gap, not because anyone is hacking.
- Locking one actor to one motivation. Financial gain fits organized crime, malicious insiders, and even some nation-state crews. Service disruption fits hacktivists, ransomware crews, and wartime nation-states. The exam will reward students who can defend two reasonable pairings and pick the strongest.
- Confusing nation-state with organized crime when ransomware is involved. Most ransomware is organized crime. A few campaigns are nation-state run for revenue, but the default reading should be organized crime unless the report says otherwise.
- Treating shadow IT as the same as bring your own device (BYOD). BYOD is a policy-managed program. Shadow IT is the unsanctioned version. Different controls apply.
Real-world context
In a SOC seat, the actor and the motivation guide pivot decisions all day long. An impossible travel alert from a finance user is not the same case if the suspected actor is a nation-state versus a criminal credential reseller. Nation-state pivots to memory forensics, beaconing analysis, and threat intel matching. Criminal credential resale pivots to credential resets, MFA enforcement, and fraud team coordination. The first ten minutes of triage are about narrowing which playbook to run.
Threat intel teams maintain profiles for major actor groups. MITRE ATT&CK Groups page is public and is a good study resource. CISA Joint Cybersecurity Advisories are public and include real indicator patterns for named campaigns. Reading two or three of each per month builds the pattern matching that makes a Tier 1 analyst faster.
Sample alert walkthrough. The SIEM (Security Information and Event Management) fires a ticket: an account in Pricing made small outbound bursts on port 443 to a cloud storage provider every 12 hours for a week. Bursts are 30 to 60 megabytes. The analyst reads the pattern. Long-running, low and slow, cloud destination, no user complaints. Suspected actor is nation-state or organized crime, depending on recent threat-intel. Motivation is data exfiltration. Next three actions: pull proxy logs, pull EDR (Endpoint Detection and Response) telemetry, notify Tier 2 with a hand-off note. That whole flow runs in under 20 minutes when the actor and motivation are named in the first read.
Sources
- CompTIA Security+ SY0-701 Exam Objectives, Section 2.1
- CISA Joint Cybersecurity Advisories (public)
- MITRE ATT&CK Groups page
- FBI Internet Crime Complaint Center (IC3) annual report
- Verizon Data Breach Investigations Report (DBIR) most recent year
- NIST SP 800-150 Guide to Cyber Threat Information Sharing